Colin & Chris Weir [email protected]

Note that the last IP shows a US IP, but if you look at IPTracker it does show the IP for 41.203.69.3 in Nigeria.

Header Analysis Quick Report
Originating IP: 8.2.176.0
Originating ISP: Level 3 Communications
City: n/a
Country of Origin: United States
* For a complete report on this email header goto ipTRACKERonline

Delivered-To: <snipped>
Received: by 10.202.73.207 with SMTP id w198csp289659oia;
Sat, 21 Mar 2015 03:31:08 -0700 (PDT)
X-Received: by 10.66.185.230 with SMTP id ff6mr197996264pac.102.1426933868159;
Sat, 21 Mar 2015 03:31:08 -0700 (PDT)
Return-Path: <[email protected]>
Received: from APAC01-HK1-obe.outbound.protection.outlook.com (mail-hk1hn0398.outbound.protection.outlook.com. [2a01:111:f400:fc18::398])
by mx.google.com with ESMTPS id fe5si13640114pdb.39.2015.03.21.03.31.06
(version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128);
Sat, 21 Mar 2015 03:31:08 -0700 (PDT)
Received-SPF: pass (google.com: domain of [email protected] designates 2a01:111:f400:fc18::398 as permitted sender) client-ip=2a01:111:f400:fc18::398;
Authentication-Results: mx.google.com;
spf=pass (google.com: domain of [email protected] designates 2a01:111:f400:fc18::398 as permitted sender) [email protected]
Received: from HKNPR03CA001.apcprd03.prod.outlook.com (10.242.116.21) by
HKXPR03MB0854.apcprd03.prod.outlook.com (25.161.182.148) with Microsoft SMTP
Server (TLS) id 15.1.118.21; Sat, 21 Mar 2015 10:31:05 +0000
Received: from BY2FFO11FD052.protection.gbl (2a01:111:f400:7c0c::162) by
HKNPR03CA001.outlook.office365.com (2a01:111:e400:a014::21) with Microsoft
SMTP Server (TLS) id 15.1.118.21 via Frontend Transport; Sat, 21 Mar 2015
10:31:05 +0000
Received: from agricom.co.jp (60.32.81.10) by
BY2FFO11FD052.mail.protection.outlook.com (10.1.15.189) with Microsoft SMTP
Server (TLS) id 15.1.125.13 via Frontend Transport; Sat, 21 Mar 2015 10:31:04
+0000
Received: from [10.185.47.42] (41.203.69.3) by ac-ex1 (192.168.0. with
Microsoft SMTP Server (TLS) id 8.2.176.0; Sat, 21 Mar 2015 19:30:19 +0900
Content-Type: text/plain; charset="iso-8859-1"
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
Content-Description: Mail message body
Subject: DONATION OF $1.5 MILLION DOLLARS!!
To: Recipients <[email protected]>
From: <[email protected]>
Date: Sat, 21 Mar 2015 03:29:55 -0700
Reply-To: <[email protected]>
Message-ID: <[email protected]>
Return-Path: [email protected]
X-EOPAttributedMessage: 0
Received-SPF: Pass (protection.outlook.com: domain of agricom.co.jp designates
60.32.81.10 as permitted sender) receiver=protection.outlook.com;
client-ip=60.32.81.10; helo=agricom.co.jp;
Authentication-Results: spf=pass (sender IP is 60.32.81.10)
[email protected]; hotmail.com; dkim=none (message not
signed) header.d=none;
X-Forefront-Antispam-Report:
CIP:<snipped>
X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:HKXPR03MB0854;
X-Microsoft-Antispam-PRVS:
<HKXPR03MB0854A714358C83491381EC02940F0@HKXPR03MB0854.apcprd03.prod.outlook.com>
X-Exchange-Antispam-Report-Test: UriScan:;
X-Exchange-Antispam-Report-CFA-Test:
BCL:0;PCL:0;RULEID:(601004)(5005006)(5002010);SRVR:HKXPR03MB0854;BCL:0;PCL:0;RULEID:;SRVR:HKXPR03MB0854;
X-Forefront-PRVS: 05220145DE
X-OriginatorOrg: agricom.co.jp
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 21 Mar 2015 10:31:04.5159
(UTC)
X-MS-Exchange-CrossTenant-Id: f6de9f4f-6ee5-4e34-9d34-fd1b750a7a04
X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f6de9f4f-6ee5-4e34-9d34-fd1b750a7a04;Ip=[60.32.81.10];Helo=[agricom.co.jp]
X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem
X-MS-Exchange-Transport-CrossTenantHeadersStamped: HKXPR03MB0854

My wife and I have awarded you with a donation of $ 1.5 million Dollars from part of our Jackpot Lottery of 161,653,000 Million Pounds, send your name,address, phone for claims.

View http://www.bbc.co.uk/news/uk-scotland-g ... t-18801698

We await your earliest response and God Bless you.

Best of luck.

Colin & Chris Weir
Reply to: [email protected]